CVE-2026-97652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97652
Published
2026-10-02T09:25:57Z
Modified
2026-10-04T02:48:22Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
Details

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key in all versions up to, and including, 14.16.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97652.json"
}
References

Affected packages

Git / github.com/wp-statistics/wp-statistics

Affected ranges

Type
GIT
Repo
https://github.com/wp-statistics/wp-statistics
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
7b0339da55f8787cf706aabdc844368424c1fac9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "14.16.14"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

12.*
12.0.10
12.0.11
12.0.12
12.0.12.1
12.0.6
12.0.7
12.0.8
12.0.8.1
12.0.9
12.1.0
12.1.1
12.1.2
12.1.3
12.2
12.3
12.3.1
12.3.2
12.3.3
12.3.4
12.3.5
12.3.6
12.3.6.1
12.3.6.2
12.3.6.4
12.4.0
12.4.1
12.4.3
12.5
12.5.1
12.5.2
12.5.3
12.5.4
12.5.5
12.5.6
12.5.7
12.6
12.6.1
12.6.10
12.6.11
12.6.12
12.6.13
12.6.2
12.6.3
12.6.4
12.6.5
12.6.6
12.6.7
12.6.8
12.6.9
13.*
13.0
13.0.3
13.0.4
13.0.5
13.0.7
v13.*
v13.2.10
v13.2.11
v13.2.12
v13.2.13
v13.2.14
v13.2.15
v13.2.16
v13.2.2
v13.2.2.1
v13.2.3
v13.2.4
v13.2.4.1
v13.2.5
v13.2.6
v13.2.7
v13.2.8
v13.2.9
v14.*
v14.0
v14.0.1
v14.0.2
v14.1
v14.1.1
v14.1.2
v14.1.3
v14.1.3.1
v14.1.4
v14.1.5
v14.1.6
v14.1.6.1
v14.1.6.2
v14.10
v14.10.1
v14.10.2
v14.10.3
v14.11
v14.11.1
v14.11.2
v14.11.3
v14.11.4
v14.12.1
v14.12.2
v14.12.3
v14.12.4
v14.12.5
v14.12.6
v14.13
v14.13.1
v14.13.2
v14.13.3
v14.13.4
v14.14
v14.14.1
v14.15
v14.15.1
v14.15.2
v14.15.3
v14.15.4
v14.15.5
v14.15.6
v14.16
v14.16.1
v14.16.10
v14.16.11
v14.16.12
v14.16.13
v14.16.14
v14.16.2
v14.16.3
v14.16.4
v14.16.5
v14.16.6
v14.16.7
v14.16.8
v14.16.9
v14.2
v14.3
v14.3.1
v14.3.2
v14.3.3
v14.3.4
v14.3.5
v14.4
v14.4.1
v14.4.2
v14.4.3
v14.4.4
v14.5
v14.5.1
v14.5.2
v14.6.0
v14.6.1
v14.6.2
v14.6.3
v14.6.4
v14.7
v14.7.1
v14.7.2
v14.8
v14.8.1
v14.9
v14.9.1
v14.9.2
v14.9.3
v14.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97652.json"